Enabling Authentication does not close all logged in socket connections immediately

低GHSA-23q2-5gf8-gjpp · 19/04/2024 公開 · 19/04/2024 更新

要点

パッケージ	影響を受けるバージョン	修正済みバージョン
uptime-kuma npm	`< 1.23.12`	`1.23.12`

This is basically GHSA-88j4-pcx8-q4q but instead of changing passwords, when enabling authentication.

Open Uptime Kuma with authentication disabled
Enable authentication using another window
Access the platform using the previously logged-in window
Note that access (read-write) remains despite the enabled authentication
Expected behaviour:
- After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.
Actual behaviour:
- The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.

TBH this is quite a niche edge case, so I don't know if this even warrants a security report.

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

パッケージ

影響を受けるバージョン

修正済みバージョン

npm

< 1.23.12

1.23.12

概要

This is basically GHSA-88j4-pcx8-q4q but instead of changing passwords, when enabling authentication.

Open Uptime Kuma with authentication disabled
Enable authentication using another window
Access the platform using the previously logged-in window
Note that access (read-write) remains despite the enabled authentication
Expected behaviour:
- After enabling authentication, all previously connected sessions should be invalidated, requiring users to log in.
Actual behaviour:
- The system retains sessions and never logs out users unless explicitly done by clicking logout or refreshing the page.

TBH this is quite a niche edge case, so I don't know if this even warrants a security report.

uptime-kuma のその他の脆弱性

すべて見る →